MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cadecd2b0afe54440902778df16f96d7b1b8b7bedd17b8c76a961d17a3a45b0e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cadecd2b0afe54440902778df16f96d7b1b8b7bedd17b8c76a961d17a3a45b0e
SHA3-384 hash: f53c05dbef6bac96ea759a09783c7c610b7019d54311305daea451551d4b75c50a8cf70ecd95c098e2c6794e89019523
SHA1 hash: db3e914794c9ae62d779141f77edb3d6201a2203
MD5 hash: 38f952ffa3caf6aa34e98a27d553a5b3
humanhash: black-cup-quebec-one
File name:invoice.jpg.scr
Download: download sample
Signature Formbook
Create hunting rule
File size:591'408 bytes
First seen:2021-02-05 18:39:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 12288:QRZ+IoG/n9IQxW3OBseyKOBibZ6Tl2NJg0r7:K2G/nvxW3W3OB0ZU2NJ/r7
Threatray 3'890 similar samples on MalwareBazaar
TLSH 3CC44982E58044B0EC655F3124376D39107BBF747E78AA5EAABCB0356BB35C25232E17
Reporter abuse_ch
Tags:FormBook scr Yahoo


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: sonic313-36.consmr.mail.ne1.yahoo.com
Sending IP: 66.163.185.59
From: Laura Tarrou <lauratarrou72@yahoo.com>
Subject: Fw: Re: Remittance
Attachment: invoice.jpg.scr.img (contains "invoice.jpg.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
invoice.jpg.scr
Verdict:
Malicious activity
Analysis date:
2021-02-05 18:40:26 UTC
Tags:
trojan rat asyncrat formbook stealer opendir
Link:
https://app.any.run/tasks/96def1f2-ac16-41e9-85ae-52e2dd78880e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/115785/
Detection(s):
SecuriteInfo.com.Trojan.Rasftuby.Gen.14.10239.27368.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file in the %temp% subdirectories
Launching a process
Creating a file
Creating a process from a recently created file
Sending a UDP request
Sending a custom TCP request
Running batch commands
Creating a process with a hidden window
Adding an access-denied ACE
DNS request
Using the Windows Management Instrumentation requests
Launching cmd.exe command interpreter
Setting browser functions hooks
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Sending a TCP request to an infection source
Forced shutdown of a system process
Sending an HTTP GET request to an infection source
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AsyncRAT FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/600607
Signature
Contains functionality to hide a thread from the debugger
Hides threads from debuggers
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Queues an APC in another process (thread injection)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected AsyncRAT
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 349323 Sample: invoice.jpg.scr Startdate: 05/02/2021 Architecture: WINDOWS Score: 100 60 www.karmaswisdom.com 2->60 62 karmaswisdom.com 2->62 74 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->74 76 Malicious sample detected (through community Yara rule) 2->76 78 Yara detected FormBook 2->78 80 5 other signatures 2->80 11 invoice.jpg.exe 11 2->11         started        signatures3 process4 file5 54 C:\Users\user\AppData\Local\...\mcchost.exe, PE32 11->54 dropped 56 C:\Users\user\AppData\Local\Temp\...\bin.exe, PE32 11->56 dropped 14 bin.exe 11->14         started        17 mcchost.exe 15 3 11->17         started        process6 dnsIp7 100 Multi AV Scanner detection for dropped file 14->100 102 Tries to detect virtualization through RDTSC time measurements 14->102 104 Injects a PE file into a foreign processes 14->104 20 bin.exe 14->20         started        58 193.239.147.103, 49714, 49730, 80 DEDIPATH-LLCUS Brunei Darussalam 17->58 106 Hides threads from debuggers 17->106 108 Contains functionality to hide a thread from the debugger 17->108 23 mcchost.exe 4 17->23         started        25 cmd.exe 1 17->25         started        27 WerFault.exe 23 9 17->27         started        signatures8 process9 signatures10 88 Injects a PE file into a foreign processes 20->88 29 bin.exe 20->29         started        32 bin.exe 20->32         started        90 Hides threads from debuggers 23->90 34 mcchost.exe 2 23->34         started        37 cmd.exe 1 23->37         started        39 conhost.exe 25->39         started        41 timeout.exe 1 25->41         started        process11 dnsIp12 94 Modifies the context of a thread in another process (thread injection) 29->94 96 Maps a DLL or memory area into another process 29->96 98 Queues an APC in another process (thread injection) 29->98 43 explorer.exe 29->43 injected 64 Alan7-50232.portmap.io 193.161.193.99, 49729, 50232 BITREE-ASRU Russian Federation 34->64 66 192.168.2.1 unknown unknown 34->66 47 conhost.exe 37->47         started        49 timeout.exe 1 37->49         started        signatures13 process14 dnsIp15 68 fiitbody.com 135.181.13.73, 49746, 80 HETZNER-ASDE Germany 43->68 70 www.quantumsoundtherapy.info 43->70 72 4 other IPs or domains 43->72 92 System process connects to network (likely due to code injection or exploit) 43->92 51 help.exe 43->51         started        signatures16 process17 signatures18 82 Modifies the context of a thread in another process (thread injection) 51->82 84 Maps a DLL or memory area into another process 51->84 86 Tries to detect virtualization through RDTSC time measurements 51->86
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/cadecd2b0afe54440902778df16f96d7b1b8b7bedd17b8c76a961d17a3a45b0e/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2021-02-05 18:40:10 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zlpm2kyk7zkeicico6g7c34w26y3rn563ul3rr3ksyorpi5elmha._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
formbook
Create hunting rule
Similar samples:
1288ae44d28cad478afd6fae196164f297b8656977fd2ac34d08ab5877a5b795
Formbook
1678611ad4996f718c0a8998ce194dfe117bf47529c4ccad51a6816ecf4f1bb4
Formbook
37e7b7329552ca9f6ab3233ebe1d8ab96c4385b941b31a21ea43c4c2b85fca61
Formbook
5c5e4e31bde29168e03fa8cce36bab9b577568137edab59f68f8968616546ed9
Formbook
7044d232a489bff666d788729e41db7c74ad7f0d94f1a212fce0694855ecd899
Formbook
9cd4df25010125f2ef3eeef44503b3c2b58435af758fe7213d053a60f018f3d8
Formbook
9cfc6d15c9f94fbd02270634f89d713e26e943cf55bf088471771144ce471633
Formbook
a806993bf26058dc6cbe82f305945d97dcf5b316115c672774950bcc0626a38d
Formbook
a943fc4408c2f59f2df0afabf3836e5adae92a8f4a4b1da0270e313d8ea78445
Formbook
d6c73d397215d259bfb6168e9c0a6c29bb8e684509877e0ec62aba0c817a25fa
Formbook
+ 3'880 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat family:formbook ransomware rat spyware stealer trojan
Link:
https://tria.ge/reports/210205-d4er7ea6a2/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
Async RAT payload
Formbook Payload
AsyncRat
Formbook
Malware Config
C2 Extraction:
Alan7-50232.portmap.io:50232
Alan7-50232.portmap.io:80
http://www.quantumsoundtherapy.info/jsw/
Unpacked files
SH256 hash:
cd27ec6fbf99477860104c4cc39816346da84b67a99dd93acefbbc459cc56cab
MD5 hash:
848bf7fca217f2f460eb305c1b80d2a7
SHA1 hash:
6fd4883bf49044ecab9f34b31533081e659e30b8
Link:
https://www.unpac.me/results/0832125b-1422-43d0-a6c6-c8d0f38efd9d/
SH256 hash:
cadecd2b0afe54440902778df16f96d7b1b8b7bedd17b8c76a961d17a3a45b0e
MD5 hash:
38f952ffa3caf6aa34e98a27d553a5b3
SHA1 hash:
db3e914794c9ae62d779141f77edb3d6201a2203
Link:
https://www.unpac.me/results/0832125b-1422-43d0-a6c6-c8d0f38efd9d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cadecd2b0afe54440902778df16f96d7b1b8b7bedd17b8c76a961d17a3a45b0e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:asyncrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
Create hunting rule
Author:ditekSHen
Description:Detects file containing reversed ASEP Autorun registry keys
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:Reverse_text_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Reverse text detected
Rule name:win_asyncrat_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects AsyncRAT
Rule name:win_asyncrat_w0
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 7fb1d4b5568ba7f8212f283ab54f87eff2e3547f9a0945e2d57d2a88e71550b2

Formbook

Executable exe cadecd2b0afe54440902778df16f96d7b1b8b7bedd17b8c76a961d17a3a45b0e

(this sample)

  
Dropped by
MD5 9157121f20211d7bc13682246b2e6c63
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/115785/
  
Dropped by
SHA256 7fb1d4b5568ba7f8212f283ab54f87eff2e3547f9a0945e2d57d2a88e71550b2

Comments